[Fix]Fix double free when memtable flush #47150

wangbo · 2025-01-17T04:31:48Z

What problem does this PR solve?

Issue Number: close #xxx

Related PR: #xxx

RowInBlock's agg_place's memory is allocated from arena, it should be released when memtable is deconstruct.
But currently arena's memory is cleared when one row is finalized(Memtable::_finalize_one_row), which means arena's non-head chunk is freed, head chunk's offset is reset ,this may cause multiple RowInBlock's share same memory, then double-free happens.

Problem Summary:

Release note

None

Check List (For Author)

Test
- Regression test
- Unit Test
- Manual test (add detailed scripts or steps below)
- No need to test or manual test. Explain why:
  - This is a refactor/code format and no logic has been changed.
  - Previous test can cover this change.
  - No code files have been changed.
  - Other reason
Behavior changed:
- No.
- Yes.
Does this need documentation?
- No.
- Yes.

Check List (For Reviewer who merge this PR)

Confirm the release note
Confirm test cases
Confirm document
Add branch pick label

==3954345==ERROR: AddressSanitizer: attempting double-free on 0x506001d3e8e0 in thread T4770 (wg_flush_broker):
    #0 0x55a340fea43d in operator delete(void*) (/mnt/disk1/chenkaijie/doris/output/be/lib/doris_be+0x5745643d) (BuildId: f79bb8af5146830f)
    #1 0x55a3410fa84e in std::__new_allocator<double>::deallocate(double*, unsigned long) /mnt/disk1/chenkaijie/env/ldb_toolchain/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/new_allocator.h:168:2
    #2 0x55a3410fa7a1 in std::allocator<double>::deallocate(double*, unsigned long) /mnt/disk1/chenkaijie/env/ldb_toolchain/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/allocator.h:210:25
    #3 0x55a3410fa7a1 in std::allocator_traits<std::allocator<double>>::deallocate(std::allocator<double>&, double*, unsigned long) /mnt/disk1/chenkaijie/env/ldb_toolchain/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/alloc_traits.h:516:13
    #4 0x55a3410fa7a1 in std::_Vector_base<double, std::allocator<double>>::_M_deallocate(double*, unsigned long) /mnt/disk1/chenkaijie/env/ldb_toolchain/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/stl_vector.h:387:4
    #5 0x55a3410fa660 in std::_Vector_base<double, std::allocator<double>>::~_Vector_base() /mnt/disk1/chenkaijie/env/ldb_toolchain/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/stl_vector.h:366:2
    #6 0x55a3410fa42a in std::vector<double, std::allocator<double>>::~vector() /mnt/disk1/chenkaijie/env/ldb_toolchain/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/stl_vector.h:735:7
    #7 0x55a3410fa2ba in doris::QuantileState::~QuantileState() /mnt/disk1/chenkaijie/doris/be/src/util/quantile_state.h:64:30
    #8 0x55a35bb3b9d6 in doris::vectorized::AggregateFunctionQuantileStateData<doris::vectorized::AggregateFunctionQuantileStateUnionOp>::~AggregateFunctionQuantileStateData() /mnt/disk1/chenkaijie/doris/be/src/vec/aggregate_functions/aggregate_function_quantile_state.h:70:8
    #9 0x55a35bb482ba in doris::vectorized::IAggregateFunctionDataHelper<doris::vectorized::AggregateFunctionQuantileStateData<doris::vectorized::AggregateFunctionQuantileStateUnionOp>, doris::vectorized::AggregateFunctionQuantileStateOp<false, doris::vectorized::AggregateFunctionQuantileStateUnionOp>>::destroy(char*) const /mnt/disk1/chenkaijie/doris/be/src/vec/aggregate_functions/aggregate_function.h:563:92
    #10 0x55a3448a56e9 in doris::MemTable::~MemTable() /mnt/disk1/chenkaijie/doris/be/src/olap/memtable.cpp:159:27
    #11 0x55a344972727 in std::_Sp_counted_ptr<doris::MemTable*, (__gnu_cxx::_Lock_policy)2>::_M_dispose() /mnt/disk1/chenkaijie/env/ldb_toolchain/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/shared_ptr_base.h:428:9
    #12 0x55a341041849 in std::_Sp_counted_base<(__gnu_cxx::_Lock_policy)2>::_M_release_last_use() /mnt/disk1/chenkaijie/env/ldb_toolchain/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/shared_ptr_base.h:175:2
    #13 0x55a34104172e in std::_Sp_counted_base<(__gnu_cxx::_Lock_policy)2>::_M_release_last_use_cold() /mnt/disk1/chenkaijie/env/ldb_toolchain/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/shared_ptr_base.h:199:9
    #14 0x55a341041633 in std::_Sp_counted_base<(__gnu_cxx::_Lock_policy)2>::_M_release() /mnt/disk1/chenkaijie/env/ldb_toolchain/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/shared_ptr_base.h:353:8
    #15 0x55a341040dfa in std::__shared_count<(__gnu_cxx::_Lock_policy)2>::~__shared_count() /mnt/disk1/chenkaijie/env/ldb_toolchain/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/shared_ptr_base.h:1071:11
    #16 0x55a344971b6a in std::__shared_ptr<doris::MemTable, (__gnu_cxx::_Lock_policy)2>::~__shared_ptr() /mnt/disk1/chenkaijie/env/ldb_toolchain/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/shared_ptr_base.h:1524:31
    #17 0x55a34496ac06 in std::shared_ptr<doris::MemTable>::~shared_ptr() /mnt/disk1/chenkaijie/env/ldb_toolchain/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/shared_ptr.h:175:11
    #18 0x55a34498406d in doris::MemtableFlushTask::~MemtableFlushTask() /mnt/disk1/chenkaijie/doris/be/src/olap/memtable_flush_executor.cpp:55:61
    #19 0x55a3449846b3 in void std::destroy_at<doris::MemtableFlushTask>(doris::MemtableFlushTask*) /mnt/disk1/chenkaijie/env/ldb_toolchain/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/stl_construct.h:88:15
    #20 0x55a3449845bc in void std::_Destroy<doris::MemtableFlushTask>(doris::MemtableFlushTask*) /mnt/disk1/chenkaijie/env/ldb_toolchain/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/stl_construct.h:149:7
    #21 0x55a344982aa8 in void std::allocator_traits<std::allocator<void>>::destroy<doris::MemtableFlushTask>(std::allocator<void>&, doris::MemtableFlushTask*) /mnt/disk1/chenkaijie/env/ldb_toolchain/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/alloc_traits.h:674:4
    #22 0x55a344982aa8 in std::_Sp_counted_ptr_inplace<doris::MemtableFlushTask, std::allocator<void>, (__gnu_cxx::_Lock_policy)2>::_M_dispose() /mnt/disk1/chenkaijie/env/ldb_toolchain/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/shared_ptr_base.h:613:2
    #23 0x55a34104120a in std::_Sp_counted_base<(__gnu_cxx::_Lock_policy)2>::_M_release() /mnt/disk1/chenkaijie/env/ldb_toolchain/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/shared_ptr_base.h:346:8
    #24 0x55a341040dfa in std::__shared_count<(__gnu_cxx::_Lock_policy)2>::~__shared_count() /mnt/disk1/chenkaijie/env/ldb_toolchain/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/shared_ptr_base.h:1071:11
    #25 0x55a3449804fa in std::__shared_ptr<doris::Runnable, (__gnu_cxx::_Lock_policy)2>::~__shared_ptr() /mnt/disk1/chenkaijie/env/ldb_toolchain/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/shared_ptr_base.h:1524:31
    #26 0x55a348393bb2 in std::__shared_ptr<doris::Runnable, (__gnu_cxx::_Lock_policy)2>::reset() /mnt/disk1/chenkaijie/env/ldb_toolchain/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/shared_ptr_base.h:1642:9
    #27 0x55a348381441 in doris::ThreadPool::dispatch_thread() /mnt/disk1/chenkaijie/doris/be/src/util/threadpool.cpp:606:23
    #28 0x55a3483c4db3 in void std::__invoke_impl<void, void (doris::ThreadPool::*&)(), doris::ThreadPool*&>(std::__invoke_memfun_deref, void (doris::ThreadPool::*&)(), doris::ThreadPool*&) /mnt/disk1/chenkaijie/env/ldb_toolchain/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/invoke.h:74:14
    #29 0x55a3483c4bb8 in std::__invoke_result<void (doris::ThreadPool::*&)(), doris::ThreadPool*&>::type std::__invoke<void (doris::ThreadPool::*&)(), doris::ThreadPool*&>(void (doris::ThreadPool::*&)(), doris::ThreadPool*&) /mnt/disk1/chenkaijie/env/ldb_toolchain/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/invoke.h:96:14
    #30 0x55a3483c4af0 in void std::_Bind<void (doris::ThreadPool::* (doris::ThreadPool*))()>::__call<void, 0ul>(std::tuple<>&&, std::_Index_tuple<0ul>) /mnt/disk1/chenkaijie/env/ldb_toolchain/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/functional:506:11
    #31 0x55a3483c48e5 in void std::_Bind<void (doris::ThreadPool::* (doris::ThreadPool*))()>::operator()<void>() /mnt/disk1/chenkaijie/env/ldb_toolchain/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/functional:591:17
    #32 0x55a3483c47de in void std::__invoke_impl<void, std::_Bind<void (doris::ThreadPool::* (doris::ThreadPool*))()>&>(std::__invoke_other, std::_Bind<void (doris::ThreadPool::* (doris::ThreadPool*))()>&) /mnt/disk1/chenkaijie/env/ldb_toolchain/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/invoke.h:61:14
    #33 0x55a3483c471e in std::enable_if<is_invocable_r_v<void, std::_Bind<void (doris::ThreadPool::* (doris::ThreadPool*))()>&>, void>::type std::__invoke_r<void, std::_Bind<void (doris::ThreadPool::* (doris::ThreadPool*))()>&>(std::_Bind<void (doris::ThreadPool::* (doris::ThreadPool*))()>&) /mnt/disk1/chenkaijie/env/ldb_toolchain/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/invoke.h:111:2
    #34 0x55a3483c41b5 in std::_Function_handler<void (), std::_Bind<void (doris::ThreadPool::* (doris::ThreadPool*))()>>::_M_invoke(std::_Any_data const&) /mnt/disk1/chenkaijie/env/ldb_toolchain/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/std_function.h:290:9
    #35 0x55a34126291f in std::function<void ()>::operator()() const /mnt/disk1/chenkaijie/env/ldb_toolchain/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/std_function.h:591:9
    #36 0x55a34833bd01 in doris::Thread::supervise_thread(void*) /mnt/disk1/chenkaijie/doris/be/src/util/thread.cpp:498:5
    #37 0x55a340faae0a in asan_thread_start(void*) crtstuff.c
    #38 0x7f2a4ca2c1c9 in start_thread (/lib64/libpthread.so.0+0x81c9) (BuildId: 9c4973af0260eccae0f087ab74e6be36ebf5e009)
    #39 0x7f2a4d41be72 in clone (/lib64/libc.so.6+0x39e72) (BuildId: 8c834ffedb2025f76ede6c27d589ae5f4becb69a)

0x506001d3e8e0 is located 0 bytes inside of 64-byte region [0x506001d3e8e0,0x506001d3e920)
freed by thread T4770 (wg_flush_broker) here:
    #0 0x55a340fea43d in operator delete(void*) (/mnt/disk1/chenkaijie/doris/output/be/lib/doris_be+0x5745643d) (BuildId: f79bb8af5146830f)
    #1 0x55a3410fa84e in std::__new_allocator<double>::deallocate(double*, unsigned long) /mnt/disk1/chenkaijie/env/ldb_toolchain/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/new_allocator.h:168:2
    #2 0x55a3410fa7a1 in std::allocator<double>::deallocate(double*, unsigned long) /mnt/disk1/chenkaijie/env/ldb_toolchain/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/allocator.h:210:25
    #3 0x55a3410fa7a1 in std::allocator_traits<std::allocator<double>>::deallocate(std::allocator<double>&, double*, unsigned long) /mnt/disk1/chenkaijie/env/ldb_toolchain/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/alloc_traits.h:516:13
    #4 0x55a3410fa7a1 in std::_Vector_base<double, std::allocator<double>>::_M_deallocate(double*, unsigned long) /mnt/disk1/chenkaijie/env/ldb_toolchain/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/stl_vector.h:387:4
    #5 0x55a3410fa660 in std::_Vector_base<double, std::allocator<double>>::~_Vector_base() /mnt/disk1/chenkaijie/env/ldb_toolchain/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/stl_vector.h:366:2
    #6 0x55a3410fa42a in std::vector<double, std::allocator<double>>::~vector() /mnt/disk1/chenkaijie/env/ldb_toolchain/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/stl_vector.h:735:7
    #7 0x55a3410fa2ba in doris::QuantileState::~QuantileState() /mnt/disk1/chenkaijie/doris/be/src/util/quantile_state.h:64:30
    #8 0x55a35bb3b9d6 in doris::vectorized::AggregateFunctionQuantileStateData<doris::vectorized::AggregateFunctionQuantileStateUnionOp>::~AggregateFunctionQuantileStateData() /mnt/disk1/chenkaijie/doris/be/src/vec/aggregate_functions/aggregate_function_quantile_state.h:70:8
    #9 0x55a35bb482ba in doris::vectorized::IAggregateFunctionDataHelper<doris::vectorized::AggregateFunctionQuantileStateData<doris::vectorized::AggregateFunctionQuantileStateUnionOp>, doris::vectorized::AggregateFunctionQuantileStateOp<false, doris::vectorized::AggregateFunctionQuantileStateUnionOp>>::destroy(char*) const /mnt/disk1/chenkaijie/doris/be/src/vec/aggregate_functions/aggregate_function.h:563:92
    #10 0x55a3448a56e9 in doris::MemTable::~MemTable() /mnt/disk1/chenkaijie/doris/be/src/olap/memtable.cpp:159:27
    #11 0x55a344972727 in std::_Sp_counted_ptr<doris::MemTable*, (__gnu_cxx::_Lock_policy)2>::_M_dispose() /mnt/disk1/chenkaijie/env/ldb_toolchain/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/shared_ptr_base.h:428:9
    #12 0x55a341041849 in std::_Sp_counted_base<(__gnu_cxx::_Lock_policy)2>::_M_release_last_use() /mnt/disk1/chenkaijie/env/ldb_toolchain/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/shared_ptr_base.h:175:2
    #13 0x55a34104172e in std::_Sp_counted_base<(__gnu_cxx::_Lock_policy)2>::_M_release_last_use_cold() /mnt/disk1/chenkaijie/env/ldb_toolchain/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/shared_ptr_base.h:199:9
    #14 0x55a341041633 in std::_Sp_counted_base<(__gnu_cxx::_Lock_policy)2>::_M_release() /mnt/disk1/chenkaijie/env/ldb_toolchain/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/shared_ptr_base.h:353:8
    #15 0x55a341040dfa in std::__shared_count<(__gnu_cxx::_Lock_policy)2>::~__shared_count() /mnt/disk1/chenkaijie/env/ldb_toolchain/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/shared_ptr_base.h:1071:11
    #16 0x55a344971b6a in std::__shared_ptr<doris::MemTable, (__gnu_cxx::_Lock_policy)2>::~__shared_ptr() /mnt/disk1/chenkaijie/env/ldb_toolchain/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/shared_ptr_base.h:1524:31
    #17 0x55a34496ac06 in std::shared_ptr<doris::MemTable>::~shared_ptr() /mnt/disk1/chenkaijie/env/ldb_toolchain/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/shared_ptr.h:175:11
    #18 0x55a34498406d in doris::MemtableFlushTask::~MemtableFlushTask() /mnt/disk1/chenkaijie/doris/be/src/olap/memtable_flush_executor.cpp:55:61
    #19 0x55a3449846b3 in void std::destroy_at<doris::MemtableFlushTask>(doris::MemtableFlushTask*) /mnt/disk1/chenkaijie/env/ldb_toolchain/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/stl_construct.h:88:15
    #20 0x55a3449845bc in void std::_Destroy<doris::MemtableFlushTask>(doris::MemtableFlushTask*) /mnt/disk1/chenkaijie/env/ldb_toolchain/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/stl_construct.h:149:7
    #21 0x55a344982aa8 in void std::allocator_traits<std::allocator<void>>::destroy<doris::MemtableFlushTask>(std::allocator<void>&, doris::MemtableFlushTask*) /mnt/disk1/chenkaijie/env/ldb_toolchain/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/alloc_traits.h:674:4
    #22 0x55a344982aa8 in std::_Sp_counted_ptr_inplace<doris::MemtableFlushTask, std::allocator<void>, (__gnu_cxx::_Lock_policy)2>::_M_dispose() /mnt/disk1/chenkaijie/env/ldb_toolchain/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/shared_ptr_base.h:613:2
    #23 0x55a34104120a in std::_Sp_counted_base<(__gnu_cxx::_Lock_policy)2>::_M_release() /mnt/disk1/chenkaijie/env/ldb_toolchain/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/shared_ptr_base.h:346:8
    #24 0x55a341040dfa in std::__shared_count<(__gnu_cxx::_Lock_policy)2>::~__shared_count() /mnt/disk1/chenkaijie/env/ldb_toolchain/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/shared_ptr_base.h:1071:11
    #25 0x55a3449804fa in std::__shared_ptr<doris::Runnable, (__gnu_cxx::_Lock_policy)2>::~__shared_ptr() /mnt/disk1/chenkaijie/env/ldb_toolchain/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/shared_ptr_base.h:1524:31
    #26 0x55a348393bb2 in std::__shared_ptr<doris::Runnable, (__gnu_cxx::_Lock_policy)2>::reset() /mnt/disk1/chenkaijie/env/ldb_toolchain/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/shared_ptr_base.h:1642:9
    #27 0x55a348381441 in doris::ThreadPool::dispatch_thread() /mnt/disk1/chenkaijie/doris/be/src/util/threadpool.cpp:606:23
    #28 0x55a3483c4db3 in void std::__invoke_impl<void, void (doris::ThreadPool::*&)(), doris::ThreadPool*&>(std::__invoke_memfun_deref, void (doris::ThreadPool::*&)(), doris::ThreadPool*&) /mnt/disk1/chenkaijie/env/ldb_toolchain/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/invoke.h:74:14
    #29 0x55a3483c4bb8 in std::__invoke_result<void (doris::ThreadPool::*&)(), doris::ThreadPool*&>::type std::__invoke<void (doris::ThreadPool::*&)(), doris::ThreadPool*&>(void (doris::ThreadPool::*&)(), doris::ThreadPool*&) /mnt/disk1/chenkaijie/env/ldb_toolchain/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/invoke.h:96:14
    #30 0x55a3483c4af0 in void std::_Bind<void (doris::ThreadPool::* (doris::ThreadPool*))()>::__call<void, 0ul>(std::tuple<>&&, std::_Index_tuple<0ul>) /mnt/disk1/chenkaijie/env/ldb_toolchain/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/functional:506:11
    #31 0x55a3483c48e5 in void std::_Bind<void (doris::ThreadPool::* (doris::ThreadPool*))()>::operator()<void>() /mnt/disk1/chenkaijie/env/ldb_toolchain/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/functional:591:17
    #32 0x55a3483c47de in void std::__invoke_impl<void, std::_Bind<void (doris::ThreadPool::* (doris::ThreadPool*))()>&>(std::__invoke_other, std::_Bind<void (doris::ThreadPool::* (doris::ThreadPool*))()>&) /mnt/disk1/chenkaijie/env/ldb_toolchain/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/invoke.h:61:14

previously allocated by thread T5686 (FragmentMgrAsyn) here:
    #0 0x55a340fe9bdd in operator new(unsigned long) (/mnt/disk1/chenkaijie/doris/output/be/lib/doris_be+0x57455bdd) (BuildId: f79bb8af5146830f)
    #1 0x55a34138341f in std::__new_allocator<double>::allocate(unsigned long, void const*) /mnt/disk1/chenkaijie/env/ldb_toolchain/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/new_allocator.h:147:27
    #2 0x55a34138331d in std::allocator<double>::allocate(unsigned long) /mnt/disk1/chenkaijie/env/ldb_toolchain/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/allocator.h:198:32
    #3 0x55a34138331d in std::allocator_traits<std::allocator<double>>::allocate(std::allocator<double>&, unsigned long) /mnt/disk1/chenkaijie/env/ldb_toolchain/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/alloc_traits.h:482:20
    #4 0x55a34138331d in std::_Vector_base<double, std::allocator<double>>::_M_allocate(unsigned long) /mnt/disk1/chenkaijie/env/ldb_toolchain/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/stl_vector.h:378:20
    #5 0x55a3413a1e1f in void std::vector<double, std::allocator<double>>::_M_realloc_insert<double const&>(__gnu_cxx::__normal_iterator<double*, std::vector<double, std::allocator<double>>>, double const&) /mnt/disk1/chenkaijie/env/ldb_toolchain/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/vector.tcc:459:33
    #6 0x55a35bb64ba3 in double& std::vector<double, std::allocator<double>>::emplace_back<double const&>(double const&) /mnt/disk1/chenkaijie/env/ldb_toolchain/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/vector.tcc:123:4
    #7 0x55a35bb5e453 in doris::QuantileState::add_value(double const&) /mnt/disk1/chenkaijie/doris/be/src/util/quantile_state.cpp:334:28
    #8 0x55a35bb5cbbb in doris::QuantileState::merge(doris::QuantileState const&) /mnt/disk1/chenkaijie/doris/be/src/util/quantile_state.cpp:242:9
    #9 0x55a35bb3e6ed in doris::vectorized::AggregateFunctionQuantileStateUnionOp::add(doris::QuantileState&, doris::QuantileState const&, bool&) /mnt/disk1/chenkaijie/doris/be/src/vec/aggregate_functions/aggregate_function_quantile_state.h:55:17
    #10 0x55a35bb3d568 in void doris::vectorized::AggregateFunctionQuantileStateData<doris::vectorized::AggregateFunctionQuantileStateUnionOp>::add<doris::QuantileState>(doris::QuantileState const&) /mnt/disk1/chenkaijie/doris/be/src/vec/aggregate_functions/aggregate_function_quantile_state.h:77:9
    #11 0x55a35bb48a36 in doris::vectorized::AggregateFunctionQuantileStateOp<false, doris::vectorized::AggregateFunctionQuantileStateUnionOp>::add(char*, doris::vectorized::IColumn const**, long, doris::vectorized::Arena*) const /mnt/disk1/chenkaijie/doris/be/src/vec/aggregate_functions/aggregate_function_quantile_state.h:127:31
    #12 0x55a3448a8f1a in doris::MemTable::_aggregate_two_row_in_block(doris::vectorized::MutableBlock&, doris::RowInBlock*, doris::RowInBlock*) /mnt/disk1/chenkaijie/doris/be/src/olap/memtable.cpp:236:30
    #13 0x55a3448f152c in void doris::MemTable::_aggregate<false>() /mnt/disk1/chenkaijie/doris/be/src/olap/memtable.cpp:443:13
    #14 0x55a3448af58d in doris::MemTable::shrink_memtable_by_agg() /mnt/disk1/chenkaijie/doris/be/src/olap/memtable.cpp:478:9
    #15 0x55a34495c07b in doris::MemTableWriter::write(doris::vectorized::Block const*, std::vector<unsigned int, std::allocator<unsigned int>> const&) /mnt/disk1/chenkaijie/doris/be/src/olap/memtable_writer.cpp:121:21
    #16 0x55a390d9c187 in doris::DeltaWriterV2::write(doris::vectorized::Block const*, std::vector<unsigned int, std::allocator<unsigned int>> const&) /mnt/disk1/chenkaijie/doris/be/src/olap/delta_writer_v2.cpp:166:30
    #17 0x55a3928f1232 in doris::vectorized::VTabletWriterV2::_write_memtable(std::shared_ptr<doris::vectorized::Block>, long, doris::vectorized::Rows const&) /mnt/disk1/chenkaijie/doris/be/src/vec/sink/writer/vtablet_writer_v2.cpp:525:24
    #18 0x55a3928eecf4 in doris::vectorized::VTabletWriterV2::write(doris::RuntimeState*, doris::vectorized::Block&) /mnt/disk1/chenkaijie/doris/be/src/vec/sink/writer/vtablet_writer_v2.cpp:468:9
    #19 0x55a3926d06d1 in doris::vectorized::AsyncResultWriter::process_block(doris::RuntimeState*, doris::RuntimeProfile*) /mnt/disk1/chenkaijie/doris/be/src/vec/sink/writer/async_result_writer.cpp:134:27
    #20 0x55a3926d4af2 in doris::vectorized::AsyncResultWriter::start_writer(doris::RuntimeState*, doris::RuntimeProfile*)::$_0::operator()() const /mnt/disk1/chenkaijie/doris/be/src/vec/sink/writer/async_result_writer.cpp:93:5
    #21 0x55a3926d48be in void std::__invoke_impl<void, doris::vectorized::AsyncResultWriter::start_writer(doris::RuntimeState*, doris::RuntimeProfile*)::$_0&>(std::__invoke_other, doris::vectorized::AsyncResultWriter::start_writer(doris::RuntimeState*, doris::RuntimeProfile*)::$_0&) /mnt/disk1/chenkaijie/env/ldb_toolchain/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/invoke.h:61:14
    #22 0x55a3926d47fe in std::enable_if<is_invocable_r_v<void, doris::vectorized::AsyncResultWriter::start_writer(doris::RuntimeState*, doris::RuntimeProfile*)::$_0&>, void>::type std::__invoke_r<void, doris::vectorized::AsyncResultWriter::start_writer(doris::RuntimeState*, doris::RuntimeProfile*)::$_0&>(doris::vectorized::AsyncResultWriter::start_writer(doris::RuntimeState*, doris::RuntimeProfile*)::$_0&) /mnt/disk1/chenkaijie/env/ldb_toolchain/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/invoke.h:111:2
    #23 0x55a3926d4405 in std::_Function_handler<void (), doris::vectorized::AsyncResultWriter::start_writer(doris::RuntimeState*, doris::RuntimeProfile*)::$_0>::_M_invoke(std::_Any_data const&) /mnt/disk1/chenkaijie/env/ldb_toolchain/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/std_function.h:290:9
    #24 0x55a34126291f in std::function<void ()>::operator()() const /mnt/disk1/chenkaijie/env/ldb_toolchain/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/std_function.h:591:9
    #25 0x55a3483a1d94 in doris::FunctionRunnable::run() /mnt/disk1/chenkaijie/doris/be/src/util/threadpool.cpp:61:27
    #26 0x55a348381430 in doris::ThreadPool::dispatch_thread() /mnt/disk1/chenkaijie/doris/be/src/util/threadpool.cpp:599:24
    #27 0x55a3483c4db3 in void std::__invoke_impl<void, void (doris::ThreadPool::*&)(), doris::ThreadPool*&>(std::__invoke_memfun_deref, void (doris::ThreadPool::*&)(), doris::ThreadPool*&) /mnt/disk1/chenkaijie/env/ldb_toolchain/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/invoke.h:74:14
    #28 0x55a3483c4bb8 in std::__invoke_result<void (doris::ThreadPool::*&)(), doris::ThreadPool*&>::type std::__invoke<void (doris::ThreadPool::*&)(), doris::ThreadPool*&>(void (doris::ThreadPool::*&)(), doris::ThreadPool*&) /mnt/disk1/chenkaijie/env/ldb_toolchain/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/invoke.h:96:14
    #29 0x55a3483c4af0 in void std::_Bind<void (doris::ThreadPool::* (doris::ThreadPool*))()>::__call<void, 0ul>(std::tuple<>&&, std::_Index_tuple<0ul>) /mnt/disk1/chenkaijie/env/ldb_toolchain/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/functional:506:11
    #30 0x55a3483c48e5 in void std::_Bind<void (doris::ThreadPool::* (doris::ThreadPool*))()>::operator()<void>() /mnt/disk1/chenkaijie/env/ldb_toolchain/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/functional:591:17
    #31 0x55a3483c47de in void std::__invoke_impl<void, std::_Bind<void (doris::ThreadPool::* (doris::ThreadPool*))()>&>(std::__invoke_other, std::_Bind<void (doris::ThreadPool::* (doris::ThreadPool*))()>&) /mnt/disk1/chenkaijie/env/ldb_toolchain/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/invoke.h:61:14

hello-stephen · 2025-01-17T04:31:53Z

Thank you for your contribution to Apache Doris.
Don't know what should be done next? See How to process your PR.

Please clearly describe your PR:

What problem was fixed (it's best to include specific error reporting information). How it was fixed.
Which behaviors were modified. What was the previous behavior, what is it now, why was it modified, and what possible impacts might there be.
What features were added. Why was this function added?
Which code was refactored and why was this part of the code refactored?
Which functions were optimized and what is the difference before and after the optimization?

wangbo requested a review from dataroaring as a code owner January 17, 2025 04:31

wangbo force-pushed the 0116_3.0_double_free_pr branch from f138dc3 to 9e65af3 Compare January 17, 2025 04:44

Fix double-free when memtable agg

24c1a40

wangbo force-pushed the 0116_3.0_double_free_pr branch from 9e65af3 to 24c1a40 Compare January 17, 2025 08:49

wangbo closed this Feb 5, 2025

wangbo mentioned this pull request Feb 5, 2025

[Fix]Fix double-free when memtable agg #47523

Merged

16 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Fix]Fix double free when memtable flush #47150

[Fix]Fix double free when memtable flush #47150

Uh oh!

wangbo commented Jan 17, 2025

Uh oh!

hello-stephen commented Jan 17, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

[Fix]Fix double free when memtable flush #47150

[Fix]Fix double free when memtable flush #47150

Uh oh!

Conversation

wangbo commented Jan 17, 2025

What problem does this PR solve?

Release note

Check List (For Author)

Check List (For Reviewer who merge this PR)

Uh oh!

hello-stephen commented Jan 17, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants